Ben Laurie blathering

Nigori Update

It’s been a while (I’ve been busy on another project, more on that soon, I hope), but finally…

I’ve updated the protocol slightly to correct a subtle bug in the secret splitting specification. You can find the latest versions and diffs here.

I’ve also finally got around to tidying the code up some (though there’s still plenty more to do), you can find an appspot server, a command line client and various libraries, all in Python, at As always, patches are welcome!

The code does not fully reflect the draft protocol yet – in particular, it still uses a Schnorr signature where the draft calls for DSA.

If you want to play with the command-line client, I already have a server running on appspot. Here’s how … from the client directory, run

$ ./ 80 register name password
200 OK

$ ./ 80 authenticate name password
200 OK

Replaying: this should fail
401 Unauthorized

$ ./ 80 add user password name secret
/usr/local/lib/python2.6/site-packages/Crypto/Util/ RandomPool_DeprecationWarning: This application uses RandomPool, which is BROKEN in older releases.  See
200 OK
Status: 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Content-Length: 0

$ ./ 80 get user password name 
0 at 1277559350.600000: secret

Not the most elegant interface in the world. Note that the server is experimental, I may break it, delete all the data, etc. Of course, you can run your own.

Note also that the whole protocol is experimental at this point, I wouldn’t rely on it to store your vital passwords just yet!

1 Comment

  1. So, er, I should probably have a bash at LastPass pending further progress on this?

    Comment by Daniel Johnston — 9 Jan 2011 @ 18:40

RSS feed for comments on this post.

Sorry, the comment form is closed at this time.

Powered by WordPress